A recently uncovered vulnerability in Microsoft’s Azure DevOps Model Context Protocol (MCP) server reveals that concealed comments within pull requests can covertly manipulate developers’ AI coding assistants, potentially leading to unauthorized data exfiltration.
Security experts at Manifold Security identified that this flaw enables attackers with access to a single project to exploit a victim’s AI agent, compelling it to extract data from projects beyond the attacker’s direct reach.
Understanding the Vulnerability
The Azure DevOps MCP server facilitates AI agents in interacting with various components such as pull requests, pipelines, wikis, and work items on behalf of users. Notably, Azure DevOps pull request descriptions support Markdown, allowing attackers to embed instructions within HTML comments. These comments remain invisible in the web interface but are processed by the API.
When a developer’s AI agent reviews such a pull request, it inadvertently processes the hidden instructions as legitimate commands. This scenario exemplifies an indirect prompt injection attack.
In a proof-of-concept demonstration, researchers embedded a comment instructing the AI agent to approve the pull request, initiate a pipeline in a separate “Payments” project, retrieve confidential information from a wiki page, and post the extracted data back as a comment. The agent, operating under the developer’s credentials, accessed data beyond the attacker’s direct permissions.
Technical Insights and Mitigation
This issue represents a “confused deputy” problem, where a privileged entity (the AI agent) is deceived into misusing its authority. The attack is particularly effective because reviewers often possess broader access rights than contributors, allowing attackers to leverage this elevated access through unseen text.
Microsoft had previously implemented a defense mechanism known as “spotlighting,” which encapsulates untrusted external content within delimiters to help the model distinguish between data and instructions. This safeguard was applied to tools handling pipeline and wiki content but was overlooked in the tool processing pull request descriptions, creating an exploitable entry point.
Manifold Security reported the vulnerability to the Microsoft Security Response Center, which acknowledged the issue. As of now, no Common Vulnerabilities and Exposures (CVE) identifier has been assigned, and a fix has yet to be released.
Recommendations for Developers
To mitigate potential risks associated with this vulnerability, developers and security teams should consider the following measures:
- Restrict AI agent tokens to the minimum necessary privileges, limiting access to the specific project under review.
- Configure agents to load only the MCP tool domains required for the task, utilizing scoping flags where applicable.
- Disable functionalities such as pipeline execution, wiki reads, and comment posting unless explicitly needed.
This incident underscores the critical need for robust security practices when integrating AI agents with development tools. Ensuring that AI systems are safeguarded against prompt injection and other manipulation techniques is essential to maintain the integrity and confidentiality of development projects.
